CVE-2026-124311

MEDIUM 5.5

Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with sps_ref_wraparound_enabled_flag set, causing reads from missing PIC_RECON_WRAP buffers and denial of service.

CWE	CWE-476
Vendor	fraunhoferhhi
Product	vvdec
Published	Nov 7, 2026

Stay Ahead of the Next One

Get instant alerts for fraunhoferhhi vvdec

Be the first to know when new medium vulnerabilities affecting fraunhoferhhi vvdec are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

fraunhoferhhi / vvdec

0 ≤ 3.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/fraunhoferhhi/vvdec/issues/420 github.com: https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06 github.com: https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/InterPrediction.cpp#L790-L796 github.com: https://github.com/fraunhoferhhi/vvdec vulncheck.com: https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-null-pointer-dereference-via-interprediction-xpredinterblk

Credits

Alexander A. Shvedov (sigdevel)